Article Details

Linux wiper malware hidden in malicious Go modules on GitHub. A supply-chain attack targets Linux servers with disk-wiping malware hidden in Golang modules published on GitHub. The campaign was detected last month and relied on three malicious Go modules that included “highly obfuscated code” for retrieving remote payloads and executing them. Complete disk destruction The attack appears designed specifically for Linux-based servers and developer environments, as the destructive payload - a Bash script named done.sh, runs a ‘dd’ command for the file-wiping activity. Furthermore, the payload verifies that it runs in a Linux environment (runtime.GOOS == "linux") before trying to execute. An analysis from supply-chain security company Socket shows that the command overwrites with zeroes every byte of data, leading to irreversible data loss and system failure. The target is the primary storage volume, /dev/sda, that holds critical system data, user files, databases, and configurations. “By populating the entire disk with zeros, the script completely destroys the file system structure, operating system, and all user data, rendering the system unbootable and unrecoverable” - Socket The researchers discovered the attack in April and identified three Go modules on GitHub, that have since been removed from the platform: All three modules contained obfuscated code that decodes into commands that use ‘wget’ to download the malicious data-wiping script (/bin/bash or /bin/sh). According to Socket researchers, the payloads are executed immediately after download, “leaving virtually no time for response or recovery.” The malicious Go modules appear to have impersonated legitimate projects for converting message data to various formats (Prototransform), a Go implementation of the Model Context Protocol (go-mcp), and a TLS proxy tool that provides encryption for TCP and HTTP servers (tlsproxy). Socket researchers warn that even minimal exposure to the analyzed destructive modules can significantly impact such as complete data loss. Because of the decentralized nature of the Go ecosystem that lacks proper checks, packages from different developers can have the same or similar names. Attackers can leverage this to create module namespaces that appear legitimate and wait for developers to integrate the malicious code into their projects. Top 10 MITRE ATT&CK© Techniques Behind 93% of Attacks Based on an analysis of 14M malicious actions, discover the top 10 MITRE ATT&CK techniques behind 93% of attacks and how to defend against them.